You may have seen messages like this in your e-mail lately:
Dear sir, We recently have determined that different computers have logged onto your (insert bank or service of your choice here) account, and multiple password failures were present before the logons. We strongly advice CHANGE YOUR PASSWORD. If this is not completed by December 13, 2005, we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes. Thank you for your cooperation. Click here to Change Your Password |
This seemingly helpful message is actually an example of a type of fraud known as "phishing" – a term coined to describe attempts to lure personal information from people by persuading them under false pretenses, usually via a fake Web site designed to look like the authentic site of a bank or other institution. This type of fraud is rapidly growing and can cause damage ranging from stealing your personal information, charging your credit card, or directly transferring money from your bank account. In some cases the fraudulent Web site will also attempt to install a virus on your system that will allow the criminals to monitor what you do and/or control your computer.
Also, recent variants have been reported that appear to target York University accounts, such as the example below:
| Dear yorku.ca Member, We must check that your yorku.ca ID was registered by real people. So, to help yorku.ca prevent automated registrations, please click on this link and complete code verification process: http://yorku.ca/sKzdJb... (long random string of letters/numbers) |
In this example, although the Web link appears to be "yorku.ca" it is not; the real location is hidden within the link and often several techniques are used to obfuscate the true destination.
Upon investigation by Computing & Network Services, these messages were not an attempt to gather personal information from York community members, but to help spammers gather free e-mail accounts for their use. The "yorku.ca" is the domain of the recipient automatically inserted into the standard text, making the message appear to be specifically for York people.
How can you protect your computer and your personal information?
- Be very suspicious of messages that ask for personal information, including account numbers or passwords. Most banks and other institutions have a policy that they will not ask for personal information via e-mail.
- Never click on links within messages that you are not certain you can trust.
- If in doubt, you can contact the institution to verify the message, or proceed to the institution's site as you normally would – via bookmark for instance, NOT clicking on the link within the message.
Reporting Fraud
Most institutions have reporting procedures for attempted fraud. To report "phishing" messages that appear to have been sent by York University, please contact CNS at abuse@yorku.ca or by phone at 416-736-5800 or ext. 55800.